PT-2019-2631 · Gnome+7 · Gnome Gvfs+7

Malte Kraus + 1 · Published 2019-05-29 · Updated 2024-06-15 · CVE-2019-12449

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNOME gvfs versions 1.29.4 through 1.41.2

Description The issue is related to the mishandling of a file's user and group ownership during move and copy operations from admin:// to file:// URIs in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in GNOME. This is due to the unavailability of root privileges. The vulnerability may allow a remote attacker to impact the integrity, confidentiality, and availability of protected information when copying files using G FILE COPY ALL METADATA.

Recommendations For versions 1.29.4 through 1.41.2, consider restricting the use of the daemon/gvfsbackendadmin.c component until a patch is available, especially when performing operations involving admin:// and file:// URIs. Avoid using the G FILE COPY ALL METADATA option for copying files between these URIs to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-275

CWE-755

Related Identifiers

ALSA-2020:1766

ALT-PU-2019-2363

ALT-PU-2019-2406

ALT-PU-2019-2783

BDU:2019-02516

CESA-2020_1766

CVE-2019-12449

MGASA-2019-0214

OPENSUSE-SU-2019:1697-1

OPENSUSE-SU-2019:1699-1

OPENSUSE-SU-2019_1697-1

OPENSUSE-SU-2019_1699-1

OPENSUSE-SU-2024:10838-1

RHSA-2020:1766

RHSA-2020_1766

RLSA-2020:1766

SUSE-SU-2019:1717-1

USN-4053-1

Affected Products

Alt Linux

Almalinux

Centos

Gnome Gvfs

Red Hat

Rocky Linux

Suse

Ubuntu

References · 149

• https://bdu.fstec.ru/vul/2019-02517 · Security Note
• https://bdu.fstec.ru/vul/2019-02514 · Security Note
• https://osv.dev/vulnerability/RLSA-2020:1766 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12795 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-12449 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ · Vendor Advisory
• https://osv.dev/vulnerability/USN-4053-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12448 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2406 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1697-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10838-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2363 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:1766 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-12449 · Vendor Advisory